Ever since the central government rolled out the Aarogya Setu app to trace COVID-19 in the country and encouraged citizens to download it, several red flags have been raised by legal and privacy experts. With the app being made mandatory for rail passengers and employees in the private and public sectors, many have pressed the government to publicly share the source code of the app. This, after allegations from Opposition parties and privacy researchers that the app, which has been downloaded over 50 million times, not only has security flaws but also compromised the data privacy of Indians downloading it.
In the absence of a data privacy law in the country, however, retired Supreme Court Justice BN Srikrishna, who led the committee which drafted the Personal Data Protection Bill, has said that the latest protocols— released in the form of an ‘order’— may not have any legal backing and should be challenged in court.
The retired judge termed the Centre’s decision to make the installation of the Aarogya Setu app mandatory, ‘utterly illegal’.
‘Advisory body can’t issue orders’
Speaking to TNM, the former judge questioned under what Section of the law the Union Government had made installing the app mandatory.
“Under what law do you mandate on anyone? So far it is not backed by any law. An executive committee is only an advisory body, they cannot be issuing orders,” he said.
The remark comes even as the Indian Railways made it mandatory for those intending to travel on trains to have the app installed.
The enforcement began after a directive from the Centre on April 29 which stated, “All the officers, staff (including outsourced staff) working in the central government should download the Aarogya Setu app on their mobile phones, immediately.”
On May 1, the Ministry of Home Affairs (MHA) stated, “Use of Aarogya Setu app shall be made mandatory for all employees, both private and public. It shall be the responsibility of the Head of the respective organisations to ensure 100% of this app among all employees.”
As part of efforts to contain the COVID-19 pandemic, the Government of India has set-up several executive committees; the latest protocol on data access and knowledge sharing was released by Executive Committee 9 on Technology and Data Management.
‘Who is accountable?’
“I have headed seven committees. Should I also have issued such orders? The Government of India never followed any of the advice from those seven committees that I headed,” slammed the retired judge.
The ‘empowered group’ was assisted by a team from Vidhi Centre for Legal Policy, a private think tank which earlier helped draft the Aadhaar Act. The group was constituted by the Centre under the Disaster Management Act, 2005.
“There are no provisions in the National Disaster Management Authority (NDMA) that would allow the Government of India to form such executive committees in the first place. Such an order needs to have parliamentary legislative backing which allows the government to issue such an order,” said (Retd) Justice Srikrishna.
He added, “The protocol does not say anything about a data breach or who is answerable if there is a data breach or what action will be taken or even who is accountable.”
Shortly after the Centre made installing of the app mandatory, John Daniel, General Secretary of Thrissur District Congress Committee, filed a petition with the Kerala High Court contending that the direction to make the app mandatory was a violation of citizens’ right to privacy and personal autonomy.
The petition notes, “Order mandating the use of the application, Arogya Setu takes away the right of a person to decide and control the use of the information pertaining to him. He is forced to give away data to a system which he may or may not approve of, thereby attacking his right of information autonomy. Autonomy guaranteed by the Constitution of India also grants individual freedom not to take part in activities he does not approve of.”
Welcoming the petition, the former judge said, “I welcome the petition, such orders and directives need to be challenged. It’s now up to the Kerala High Court to strike it down or the matter would eventually reach the Supreme Court.”
Following the Centre’s directives, the Noida police issued an order stating that those who have not installed the app could face fines up to Rs 1,000 or imprisonment for upto six months.
Terming the police order ‘totally unlawful’, (Retd) Justice Srikrishna was quoted in the Indian Express as saying, “I am assuming this is still a democratic country and such orders can be challenged in court.”